openspec-plus-design
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill relies on external documentation files as inputs for its design logic, which could contain malicious instructions designed to influence the agent's output.
- Ingestion points: Processes
proposal.md,spec.md,AGENTS.md,CLAUDE.md,GEMINI.md, and configuration files likeopenspec/.plus/config.yamlfound in SKILL.md. - Boundary markers: Does not implement specific boundary markers or instructions to ignore embedded prompts within the ingested files.
- Capability inventory: The skill can execute shell commands via
openspec, perform file writes to anoutputPath, and dispatch subagents. - Sanitization: Content from external sources is used directly without defined sanitization or validation steps.
- [COMMAND_EXECUTION]: The skill executes the
openspecCLI tool (e.g.,openspec instructions design --change <name> --json) to retrieve design templates and rules. The use of variables like<name>in the shell command represents a potential path for command argument injection if the calling agent does not correctly sanitize user-provided task names.
Audit Metadata